Cisco Cisco Firepower Management Center 2000 Guida Dello Sviluppatore
A-8
FireSIGHT eStreamer Integration Guide
Appendix A Data Structure Examples
Intrusion Event Data Structure Examples
In the preceding example, the following packet information appears:
Example of a Classification Record
The following diagram shows an example classification record:
11
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 1 1 1 0 0 1
12
0 0 1 1 0 0 0 0 0 1 1 1 1 0 0 0 0 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0
0 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 1 1 0 1 0 0 0 1 0 0 0 0 0
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Number Description
1
The first two bytes of this line indicate the standard header value of
1
. The second two bytes
indicate that the message is a data message (message type four).
2
This line indicates that the message that follows is
989
bytes long.
3
This line indicates a record type value of
2
, which represents a packet record.
4
This line indicates that the packet record that follows is
981
bytes long.
5
This line indicates that the event is collected from device number
3
.
6
This line indicates that the event identification number is
195430
.
7
This line indicates that the event occurred at second
1057259378
.
8
This line indicates that the packet was collected at second
1057259380
.
9
This line indicates that the packet was collected at microsecond
254365
.
10
This line indicates that the link type is
1
(Ethernet layer).
11
This line indicates that the packet data that follows is
953
bytes long.
12
This line and the following line show the actual payload data. Note that the actual data is
953
bytes and has been truncated for the sake of this example.
Byte
0
1
2
3
Bit
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0
2
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 0 0
3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1
4
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 1 0 0
5
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0